facebook/hhvm — pull request #4231 by swtaarrs (2014-11-11 23:55:12+00:00)
Title: Fix a few memory management issues in DOMDocument, 3.3.x version

This is a port of ec5b84cfa0069 to the 3.3 branch. The main
complication was that DOMDocument was converted to hni between 3.3 and
now.

php_dom_create_object wasn't inserting the new object in the orphan
set if it already existed. This was causing certain objects obtained
with DOMNode::removeChild() to leak permanently.

DOMNode::replaceChild() wasn't removing the newly inserted element from its
orphan set, potentially causing a double-free during sweep. And it wasn't
inserting the old, unlinked element into the orphan set, causing that object to
leak.